@@ -0,0 +1,16 @@
+---
+'@objectstack/lint': minor
+---
+
+`os validate`, `os build` and `os lint` now check every keyed child of an action's translation entry against what the action declares, under both `objects.OBJECT._actions.ACTION` and `globalActions.ACTION`. Before this, only `params.NAME` was checked.
+
+Clause-②: yes
+
+**What is refused.** Two keys are new `translation-target-unknown` errors, the same code and level an undeclared `params` key already gets:
+
+- `outcomeMessages.OUTCOME` when the action's own `outcomeMessages` does not declare that outcome, or declares no `outcomeMessages` at all. `translateAction` overlays only the outcomes the action declares, so such copy is never shown.
+- `resultDialog.fields.PATH` when no entry of the action's `resultDialog.fields[]` has that literal `path`, or the action declares no `resultDialog` or a dialog with no `fields`. The label lookup is keyed by each declared field's `path`, dots included, so such a label is never shown. The finding's config path quotes a dotted key as one member (`resultDialog.fields["client.ghost"]`).
+
+**What is warned.** `params.NAME.options.VALUE` under a declared param is judged against that param's inline `options[].value`. It is a `translation-option-key-unknown` warning, the code and level a field's `options` key already gets, and it names the stored value when the key is a display label. An options map under a param with no inline options and no `field` is warned once, because nothing reads it. A field-backed param with no inline `options` inherits its list from the field when the dialog renders, so its option keys are not judged.
+
+**What changes for a project.** A bundle that carries one of the refused keys now fails `os validate` with exit 1 instead of passing, and `os build` refuses it. The fix is to rename the key to a declared outcome or result-field `path`, declare the outcome or field on the action first, or delete the key. The option-key warning changes an exit code only under `--strict`. The four example apps (`app-crm`, `app-todo`, `app-showcase`, `app-multi-package`) and the bundle shipped with `@objectstack/platform-objects` produce no finding on any of these keys, so none of their exit codes change.
@@ -4,7 +4,7 @@ import { describe, it, expect } from 'vitest';
 // The contract the object branch's coverage is pinned against (#13835) — see
 // the coverage describe block at the foot of this file. `@objectstack/spec` is
 // already a runtime dependency of this package, so the pin adds no edge.
-import { ObjectTranslationDataSchema } from '@objectstack/spec/system';
+import { ObjectTranslationDataSchema, TranslationDataSchema } from '@objectstack/spec/system';
 // The schema the #18441 fold is SIZED against — see the surface pin in that
 // block. Same package, already a runtime dependency, so no new edge either.
 import { ObjectExtensionSchema } from '@objectstack/spec/data';
@@ -3073,3 +3073,341 @@ describe('validateTranslationReferences — object-branch coverage vs the schema
     expect(findings).toEqual([]);
   });
 });
+
+/**
+ * #21216 — every KEYED child of an action's translation entry, judged against
+ * the declaration `translateAction` reads it through, at both addresses
+ * (`objects.<obj>._actions.<name>` and `globalActions.<name>`).
+ *
+ * `params.<name>` was the only one judged; `outcomeMessages.<outcome>` (#21095)
+ * and `resultDialog.fields.<path>` joined the shape with no leg following, so a
+ * key the action does not declare parsed, linted clean and was read by nothing.
+ */
+describe('validateTranslationReferences — keyed children of an action entry (#21216)', () => {
+  /**
+   * Spec-legal actions, one per keyed group, bound and object-less. Kept apart
+   * because `outcomeMessages` is refused beside `resultDialog`.
+   */
+  const actionStack = (bundle: Record<string, unknown>) => ({
+    objects: [{ name: 'crm_env', label: 'Env', fields: { name: { type: 'text', label: 'Name' } } }],
+    actions: [
+      {
+        name: 'archive_env',
+        label: 'Archive',
+        objectName: 'crm_env',
+        type: 'script',
+        target: 'archiveEnv',
+        outcomeMessages: { archived: 'Archived.', already_archived: 'Already archived.' },
+        params: [
+          {
+            name: 'mode',
+            label: 'Mode',
+            type: 'select',
+            options: [
+              { value: 'soft', label: 'Soft' },
+              { value: 'hard', label: 'Hard delete' },
+            ],
+          },
+          { field: 'name' },
+          { name: 'reason', label: 'Reason', type: 'text' },
+        ],
+      },
+      {
+        name: 'rotate_secret',
+        label: 'Rotate',
+        objectName: 'crm_env',
+        type: 'api',
+        target: '/api/v1/rotate',
+        resultDialog: { title: 'Secret', fields: [{ path: 'client.secret', label: 'Secret' }, { path: 'token' }] },
+      },
+      { name: 'plain_env', label: 'Plain', objectName: 'crm_env', type: 'script', target: 'plainEnv' },
+      {
+        name: 'check_updates',
+        label: 'Check',
+        type: 'api',
+        target: '/api/v1/updates',
+        outcomeMessages: { up_to_date: 'Up to date.' },
+      },
+      {
+        name: 'mint_token',
+        label: 'Mint',
+        type: 'api',
+        target: '/api/v1/mint',
+        resultDialog: { fields: [{ path: 'token' }] },
+      },
+    ],
+    translations: [{ 'zh-CN': bundle }],
+  });
+  const onEnv = (actions: Record<string, unknown>) => ({ objects: { crm_env: { _actions: actions } } });
+  const ENV = 'translations[0]["zh-CN"].objects.crm_env._actions';
+  const GLOBAL = 'translations[0]["zh-CN"].globalActions';
+
+  describe('outcomeMessages.<outcome>', () => {
+    it('refuses an outcome `_actions.<name>` does not declare, at the code and level `params` uses', () => {
+      const findings = validateTranslationReferences(
+        actionStack(onEnv({ archive_env: { outcomeMessages: { archived: '已归档。', restored: '已恢复。' } } })),
+      );
+      expect(findings.map((f) => [f.rule, f.severity, f.path])).toEqual([
+        [TRANSLATION_TARGET_UNKNOWN, 'error', `${ENV}.archive_env.outcomeMessages.restored`],
+      ]);
+    });
+
+    it('refuses an outcome `globalActions.<name>` does not declare', () => {
+      const findings = validateTranslationReferences(
+        actionStack({ globalActions: { check_updates: { outcomeMessages: { up_to_date: '已是最新。', stale: '已过期。' } } } }),
+      );
+      expect(findings.map((f) => [f.rule, f.severity, f.path])).toEqual([
+        [TRANSLATION_TARGET_UNKNOWN, 'error', `${GLOBAL}.check_updates.outcomeMessages.stale`],
+      ]);
+    });
+
+    it('accepts every outcome the action declares, at both addresses (the control)', () => {
+      expect(
+        validateTranslationReferences(
+          actionStack({
+            ...onEnv({ archive_env: { outcomeMessages: { archived: '已归档。', already_archived: '早已归档。' } } }),
+            globalActions: { check_updates: { outcomeMessages: { up_to_date: '已是最新。' } } },
+          }),
+        ),
+      ).toEqual([]);
+    });
+
+    it('refuses every outcome on an action that declares no `outcomeMessages` — nothing reads the map', () => {
+      const findings = validateTranslationReferences(
+        actionStack(onEnv({ plain_env: { outcomeMessages: { archived: '已归档。' } } })),
+      );
+      expect(findings.map((f) => [f.rule, f.severity, f.path])).toEqual([
+        [TRANSLATION_TARGET_UNKNOWN, 'error', `${ENV}.plain_env.outcomeMessages.archived`],
+      ]);
+    });
+  });
+
+  describe('resultDialog.fields.<path>', () => {
+    it('refuses a result field `_actions.<name>` does not declare, quoting a dotted path as ONE key', () => {
+      const findings = validateTranslationReferences(
+        actionStack(
+          onEnv({
+            rotate_secret: {
+              resultDialog: { title: '密钥', fields: { 'client.secret': '密钥', token: '令牌', 'client.ghost': '幽灵' } },
+            },
+          }),
+        ),
+      );
+      expect(findings.map((f) => [f.rule, f.severity, f.path])).toEqual([
+        [TRANSLATION_TARGET_UNKNOWN, 'error', `${ENV}.rotate_secret.resultDialog.fields["client.ghost"]`],
+      ]);
+    });
+
+    it('refuses a result field `globalActions.<name>` does not declare', () => {
+      const findings = validateTranslationReferences(
+        actionStack({ globalActions: { mint_token: { resultDialog: { fields: { token: '令牌', ghost_token: '幽灵' } } } } }),
+      );
+      expect(findings.map((f) => [f.rule, f.severity, f.path])).toEqual([
+        [TRANSLATION_TARGET_UNKNOWN, 'error', `${GLOBAL}.mint_token.resultDialog.fields.ghost_token`],
+      ]);
+    });
+
+    it('accepts every declared path, at both addresses (the control)', () => {
+      expect(
+        validateTranslationReferences(
+          actionStack({
+            ...onEnv({ rotate_secret: { resultDialog: { fields: { 'client.secret': '密钥', token: '令牌' } } } }),
+            globalActions: { mint_token: { resultDialog: { title: '令牌', fields: { token: '令牌' } } } },
+          }),
+        ),
+      ).toEqual([]);
+    });
+
+    it('refuses a result field on an action that declares no `resultDialog`', () => {
+      const findings = validateTranslationReferences(
+        actionStack(onEnv({ plain_env: { resultDialog: { fields: { token: '令牌' } } } })),
+      );
+      expect(findings.map((f) => [f.rule, f.severity, f.path])).toEqual([
+        [TRANSLATION_TARGET_UNKNOWN, 'error', `${ENV}.plain_env.resultDialog.fields.token`],
+      ]);
+    });
+  });
+
+  describe('params.<name>.options.<value>', () => {
+    it('warns on an option key a declared param does not declare, as the field `options` leg does', () => {
+      const findings = validateTranslationReferences(
+        actionStack(
+          onEnv({
+            archive_env: { params: { mode: { options: { soft: '软', hard: '硬', 'Hard delete': '彻底删除', purge: '清除' } } } },
+          }),
+        ),
+      );
+      expect(findings.map((f) => [f.rule, f.severity, f.path])).toEqual([
+        [TRANSLATION_OPTION_KEY_UNKNOWN, 'warning', `${ENV}.archive_env.params.mode.options.Hard delete`],
+        [TRANSLATION_OPTION_KEY_UNKNOWN, 'warning', `${ENV}.archive_env.params.mode.options.purge`],
+      ]);
+    });
+
+    it('warns once on an options map under a param that declares no options and references no field', () => {
+      const findings = validateTranslationReferences(
+        actionStack(onEnv({ archive_env: { params: { reason: { label: '原因', options: { a: 'A' } } } } })),
+      );
+      expect(findings.map((f) => [f.rule, f.severity, f.path])).toEqual([
+        [TRANSLATION_OPTION_KEY_UNKNOWN, 'warning', `${ENV}.archive_env.params.reason.options`],
+      ]);
+    });
+
+    it('leaves a FIELD-BACKED param with no inline options unjudged — its list is inherited at render time', () => {
+      expect(
+        validateTranslationReferences(
+          actionStack(onEnv({ archive_env: { params: { name: { label: '名称', options: { anything: '任意' } } } } })),
+        ),
+      ).toEqual([]);
+    });
+
+    it('judges an undeclared param once, as the param — never its option keys as well', () => {
+      const findings = validateTranslationReferences(
+        actionStack(onEnv({ archive_env: { params: { ghost: { options: { soft: '软' } } } } })),
+      );
+      expect(findings.map((f) => [f.rule, f.severity, f.path])).toEqual([
+        [TRANSLATION_TARGET_UNKNOWN, 'error', `${ENV}.archive_env.params.ghost`],
+      ]);
+    });
+  });
+
+  /**
+   * The action-entry twin of the #13835 object-branch pin above: every key the
+   * action translation shape declares — down into `params.<name>.*` and
+   * `resultDialog.*` — classified, and every `reference-checked` claim backed
+   * by a ghost that must report at BOTH addresses. A keyed group that joins the
+   * shape with no leg now fails here, which is how `outcomeMessages` went
+   * unjudged.
+   */
+  describe('coverage vs the action translation shape', () => {
+    type ShapeNode = {
+      _zod: { def: { type: string; innerType?: ShapeNode; valueType?: ShapeNode } };
+      shape?: Record<string, ShapeNode>;
+    };
+    /** Unwrap optional / record wrappers down to the object shape they hold. */
+    const objectShapeOf = (schema: unknown): Record<string, ShapeNode> => {
+      let node = schema as ShapeNode;
+      while (!node.shape) {
+        const def = node._zod.def;
+        const next = def.type === 'record' ? def.valueType : def.innerType;
+        if (!next) throw new Error(`no object shape under a "${def.type}" node`);
+        node = next;
+      }
+      return node.shape;
+    };
+    const entryKeys = (address: unknown): string[] => {
+      const entry = objectShapeOf(address);
+      return [
+        ...Object.keys(entry),
+        ...Object.keys(objectShapeOf(entry.params)).map((k) => `params.*.${k}`),
+        ...Object.keys(objectShapeOf(entry.resultDialog)).map((k) => `resultDialog.${k}`),
+      ].sort();
+    };
+
+    type Address = 'bound' | 'global';
+    /** Which declared action a ghost is written under, per address. */
+    const HOST: Record<'outcome' | 'dialog', Record<Address, string>> = {
+      outcome: { bound: 'archive_env', global: 'check_updates' },
+      dialog: { bound: 'rotate_secret', global: 'mint_token' },
+    };
+    type Coverage =
+      | { kind: 'reference-checked'; host: 'outcome' | 'dialog'; ghost: Record<string, unknown>; suffix: string; rule: string }
+      | { kind: 'leaf-copy' | 'container'; why: string };
+
+    const COVERAGE: Record<string, Coverage> = {
+      label: { kind: 'leaf-copy', why: 'prose' },
+      description: { kind: 'leaf-copy', why: 'prose' },
+      confirmText: { kind: 'leaf-copy', why: 'prose' },
+      successMessage: { kind: 'leaf-copy', why: 'prose' },
+      outcomeMessages: {
+        kind: 'reference-checked',
+        host: 'outcome',
+        ghost: { outcomeMessages: { ghost_outcome: 'x' } },
+        suffix: '.outcomeMessages.ghost_outcome',
+        rule: TRANSLATION_TARGET_UNKNOWN,
+      },
+      params: {
+        kind: 'reference-checked',
+        host: 'outcome',
+        ghost: { params: { ghost_param: { label: 'x' } } },
+        suffix: '.params.ghost_param',
+        rule: TRANSLATION_TARGET_UNKNOWN,
+      },
+      'params.*.label': { kind: 'leaf-copy', why: 'prose' },
+      'params.*.helpText': { kind: 'leaf-copy', why: 'prose' },
+      'params.*.placeholder': { kind: 'leaf-copy', why: 'prose' },
+      'params.*.options': {
+        kind: 'reference-checked',
+        host: 'outcome',
+        ghost: { params: { mode: { options: { ghost_value: 'x' } } } },
+        suffix: '.params.mode.options.ghost_value',
+        rule: TRANSLATION_OPTION_KEY_UNKNOWN,
+      },
+      resultDialog: { kind: 'container', why: 'a fixed-key node; its keyed child is `resultDialog.fields`' },
+      'resultDialog.title': { kind: 'leaf-copy', why: 'prose' },
+      'resultDialog.description': { kind: 'leaf-copy', why: 'prose' },
+      'resultDialog.acknowledge': { kind: 'leaf-copy', why: 'prose' },
+      'resultDialog.fields': {
+        kind: 'reference-checked',
+        host: 'dialog',
+        ghost: { resultDialog: { fields: { ghost_path: 'x' } } },
+        suffix: '.resultDialog.fields.ghost_path',
+        rule: TRANSLATION_TARGET_UNKNOWN,
+      },
+    };
+
+    // The global action needs a param with inline options for the options ghost.
+    const coverageStack = (bundle: Record<string, unknown>) => {
+      const stack = actionStack(bundle);
+      const check = stack.actions.find((a) => a.name === 'check_updates') as Record<string, unknown>;
+      check.params = [{ name: 'mode', label: 'Mode', type: 'select', options: [{ value: 'soft', label: 'Soft' }] }];
+      return stack;
+    };
+    const bundleAt = (address: Address, actionName: string, node: Record<string, unknown>) =>
+      address === 'bound' ? onEnv({ [actionName]: node }) : { globalActions: { [actionName]: node } };
+
+    it('classifies every key the action translation shape declares, at both addresses', () => {
+      const bound = entryKeys((ObjectTranslationDataSchema as unknown as { shape: Record<string, unknown> }).shape._actions);
+      const global = entryKeys((TranslationDataSchema as unknown as { shape: Record<string, unknown> }).shape.globalActions);
+      expect(global).toEqual(bound);
+      expect(Object.keys(COVERAGE).sort()).toEqual(bound);
+    });
+
+    it('backs every `reference-checked` claim with a leg that reports at both addresses', () => {
+      for (const [key, coverage] of Object.entries(COVERAGE)) {
+        if (coverage.kind !== 'reference-checked') continue;
+        for (const address of ['bound', 'global'] as const) {
+          const actionName = HOST[coverage.host][address];
+          const findings = validateTranslationReferences(
+            coverageStack(bundleAt(address, actionName, coverage.ghost)),
+          );
+          const prefix = address === 'bound' ? `${ENV}.${actionName}` : `${GLOBAL}.${actionName}`;
+          expect(findings.map((f) => f.path), `"${key}" has no working leg at the ${address} address`).toEqual([
+            `${prefix}${coverage.suffix}`,
+          ]);
+          expect(findings[0].rule).toBe(coverage.rule);
+        }
+      }
+    });
+
+    it('accepts the real instance of every keyed group at both addresses at once', () => {
+      const real = (address: Address): Record<string, unknown> => {
+        const outcome = HOST.outcome[address];
+        const dialog = HOST.dialog[address];
+        return {
+          [outcome]: {
+            label: 'x',
+            description: 'x',
+            confirmText: 'x',
+            successMessage: 'x',
+            outcomeMessages: address === 'bound' ? { archived: 'x' } : { up_to_date: 'x' },
+            params: { mode: { label: 'x', helpText: 'x', placeholder: 'x', options: { soft: 'x' } } },
+          },
+          [dialog]: { resultDialog: { title: 'x', description: 'x', acknowledge: 'x', fields: { token: 'x' } } },
+        };
+      };
+      expect(
+        validateTranslationReferences(coverageStack({ ...onEnv(real('bound')), globalActions: real('global') })),
+      ).toEqual([]);
+    });
+  });
+});